Onetime Secret alternative: OncePad vs Onetime Secret

Both share a secret through a link that works once. The difference is where the key lives.

Short answer: OncePad is a free, no-account service for sharing a password, secret, or file through an end-to-end encrypted link. The link contains no decryption key, works once, and expires after 24 hours. Files may be up to 25 MB.

Where they agree

Onetime Secret is the long-running original in this space, and the shape is the same: paste a secret, get a link, the recipient opens it once, it's gone. Both are free to use without an account and both support passphrase protection. If you're happy with Onetime Secret, this page won't try to talk you out of it — it explains what OncePad does differently so you can pick the model you want.

The core difference: browser encryption, and a link that carries no key

Onetime Secret documents server-side encryption, encryption at rest, and optional passphrase protection. OncePad starts from the other end: encryption always happens in your browser (AES-256-GCM, key derived by PBKDF2 from a passphrase), the server never receives anything but ciphertext, and the passphrase is generated (7 words, ~72 bits) for every secret. The OncePad link therefore carries no key; the words go on a second channel.

Side by side

FeatureOncePadOnetime Secret
Encryption locationBrowser, before upload (end-to-end)Server-side; encrypted in transit and at rest
Key placementDerived from a generated passphrase sent separately; no key in linkService-managed encryption; optional user passphrase
File support / limitOne browser-encrypted file up to 25 MBNo file-upload limit documented in the primary pages reviewed
ExpiryExactly one reveal or 24 hoursOne retrieval; lifetime configurable within plan limits
AccountsNo accountAnonymous use plus optional accounts/plans
Open-source statusHosted app source not publicly releasedOpen source; official documentation links the repository

When Onetime Secret may suit you better

If you want optional passphrase protection, longer expiry windows, regional hosting, an account with additional features, an API, or a mature self-hosting story, Onetime Secret offers those. OncePad deliberately trades that flexibility for a smaller surface: one model, no accounts, nothing on disk for text secrets.

When OncePad is the better fit

If the requirement is that no server ever holds the key, that the link can sit safely in a ticket or chat log, that the passphrase is strong by default rather than by discipline, and that the whole thing is gone from memory after one read — that is exactly what OncePad is built for.

Last verified: August 18, 2026. Descriptions of Onetime Secret are based on its primary documentation and are given in good faith; editions, limits, and policies change, so verify them before deciding. Onetime Secret is a trademark of its respective owner and is not affiliated with OncePad.